Boligposten

Privacy Policy

Our privacy policy and how we use your data

Privacy Policy for Boligposten

Last updated: 2 September 2026

1. Controller

Webagent AS Norwegian company registration no.: 936 671 225 Address: Østre Stiaberget 60, 5179 Godvik, Norway Email: support@boligposten.com

This policy covers data about you as a user of Boligposten and about visitors to boligposten.com and My page. For data you enter about others (prospective buyers, sellers), you are the controller and we are the processor, see the Terms section 11.

2. What data we process, why and on what basis

Account data Data: name, email address, phone number, profile picture, business, billing details Purpose: create and manage your account, invoice, provide support Basis: performance of a contract (Art. 6(1)(b)); Norwegian bookkeeping law for payment history (Art. 6(1)(c))

Data from your Finn agent profile Data: agent name, photo, office, property listings you have published (address, price, text, images, status) Purpose: bring your properties into the service and draft posts Basis: performance of a contract (Art. 6(1)(b))

Connected channels Data: access tokens for Facebook pages, Instagram accounts and LinkedIn profiles (encrypted), metadata about published posts Purpose: publish content on your behalf and show you status and insights Basis: performance of a contract (Art. 6(1)(b))

Content and usage Data: drafts, published posts, images, status changes, event log for your properties Purpose: provide the service, show history, troubleshoot Basis: performance of a contract (Art. 6(1)(b))

Connection to your own assistant Data: authorisation (OAuth token), log of actions the assistant performs in Boligposten Purpose: let you use the service from your assistant and document what was done Basis: performance of a contract (Art. 6(1)(b))

Technical usage data and error reports Data: login activity, features used, error messages, browser and device Purpose: operation, security and improvement of the service Basis: legitimate interest (Art. 6(1)(f)) in running a stable and secure service

Usage analytics Data: page views, clicks and events in the service. Before you give consent: anonymous, without cookies and without identifying you. After consent: with cookies, linked to your account when you are logged in, and with registration of how you navigate, click and move within the service Purpose: understand how the service is used, find errors and improve it Basis: legitimate interest (Art. 6(1)(f)) for anonymous measurement; consent (Art. 6(1)(a)) for cookies, identification and registration of navigation. Consent can be withdrawn in the cookie settings

Visits to My page (public) Data: page views and clicks per property, without cookies and without identifying visitors Purpose: show the agent how many people have viewed the property Basis: legitimate interest (Art. 6(1)(f))

Prospective buyers contacting you via My page Data: name, email, phone, message, which property Purpose: forward the enquiry to the agent Basis: the agent is the controller; we process as processor (Terms section 11)

3. Automated processing

Boligposten drafts texts and images automatically based on the information about the property. For this we use language and image models from external providers. Drafts are suggestions: no text is published without your approval. We make no decisions with legal or similarly significant effect on you based solely on automated processing (Art. 22).

Boligposten also monitors the listings on your Finn profile and notifies you of changes (new property, price change, sold). The notification is information to you; the property's status in Boligposten changes only when you confirm.

4. Who we share data with

We do not sell your data. We share only with providers that help us deliver the service, and only what is necessary for the purpose. Categories of recipients:

  • Hosting and storage: cloud service providers for database, authentication, file storage, application hosting and image and video production
  • Payment: our payment provider (Stripe), which processes your card details directly; we do not store card numbers
  • Automated text and image processing: providers of language and image models, which receive property information and the content of your requests, not your account data
  • Publishing: the channels you connect yourself (Facebook, Instagram, LinkedIn), which receive content you have approved
  • Email: provider for sending email from the service
  • Error tracking and operations: provider that receives technical error reports with user ID
  • Usage analytics: analytics provider with servers in the EU, which receives usage data as described in section 2

If you are an agent and controller of data you enter about others (Terms section 11), you can obtain a full list of our sub-processors on request to support@boligposten.com.

If you connect your own assistant (Claude, ChatGPT or another), the data the assistant requests is transferred directly to the assistant's provider on your instruction. The provider's own privacy policy governs that processing.

We may also disclose data where required by law.

5. Transfers outside the EU/EEA

Some providers process data in the United States. Transfers are based on the EU Standard Contractual Clauses (SCC) and, where the provider is certified, the EU-U.S. Data Privacy Framework. Contact us for a copy of the safeguards.

6. Retention

  • Account data and content: for as long as the account is active. Deleted within 30 days after the account is closed.
  • Payment and invoice history: 5 years after the end of the financial year (Norwegian bookkeeping law).
  • Enquiries from prospective buyers: as the agent, you are the controller and decide how long enquiries are kept. We recommend deleting enquiries when they are no longer needed for the assignment, normally within 24 months. We never delete enquiries on our own initiative while your account is active. When the account is closed, they are deleted within 30 days unless you ask to have them returned first.
  • Technical logs and error reports: up to 90 days.
  • Backups: up to 30 days after deletion.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw consent at any time. Send your request to support@boligposten.com. We respond within 30 days.

8. Security

  • All traffic is encrypted (TLS).
  • Passwords are stored only as hashes. Passwordless login and two-factor authentication are available.
  • Access tokens for connected channels are stored encrypted.
  • Data access is restricted per account in the database (row-level security), and access is tested automatically.
  • Employees and providers are given access only where necessary.

9. Cookies

See our Cookie Policy.

10. Children

The service is for professionals and is not directed at persons under 18.

11. Changes

We may update this policy. For material changes we notify you by email at least 30 days before the change takes effect.

12. Complaints

You may complain to the Norwegian Data Protection Authority (Datatilsynet): Postboks 458 Sentrum, 0105 Oslo, Norway Phone: +47 22 39 69 00 Email: postkasse@datatilsynet.no www.datatilsynet.no

You may also complain to the supervisory authority in the country where you live or work.